Hi, I'm James and I'm Richard, and we're both tech and data specialists in Fieldfisher's Silicon Valley Office.

In today's bite-size legal update, we're going to be looking at the recent decision of the Court of Justice of the European Union in Dunn and Bradstreet.

So, in this case, we had an individual who was refused a 10-euro monthly phone contract on the basis of a creditworthiness assessment carried out by Dun & Bradstreet, or D&B as we might

be referring to them. And the question for the court was essentially, what information did D&B have to disclose

to the data subject?

And how does this interact with the business's interest in protecting their trade secrets?

So, Richard, this isn't the first time we've heard from the CJAEU about automated decision

making.

What was the context of the previous case law?

And where are we now?

Yeah, if you recall, the CJAU has issued a judgment on automated decision making before.

So in December 2023, it issued its ruling in the Schufer case.

And in that case, it said that a credit reference agency engages in automated decision-making under Article 22 of the GPR when it generates

a credit score as a result of automated processing, and then makes that available to lenders

who rely heavily on the score to establish or terminate contracts

with individuals. That was a really important case because it established the principle that a

controller might be engaged in automated decision making, even if it is not directly

making automated decisions, but instead generating information that others may rely on for those decisions.

Naturally, that case had significant consequences for credit rating agencies, but it potentially

is also relevant for other types of businesses involved in providing scores, assessments,

insights, or information to others that might be relied on in an automated processing

context. So if you think about AI and the wave of new tools and applications that are being

...